@@ -341,15 +341,15 @@ export class Trx extends BaseCoin {
341341 * @param callback
342342 * @returns {BigNumber } address balance
343343 */
344- getAccountBalanceFromNode ( address : string , callback ?: NodeCallback < any > ) : Bluebird < any > {
344+ getAccountFromNode ( address : string , callback ?: NodeCallback < any > ) : Bluebird < any > {
345345 const self = this ;
346346 return co ( function * ( ) {
347347 const result = yield self . recoveryPost ( {
348348 path : '/walletsolidity/getaccount' ,
349349 jsonObj : { address } ,
350350 node : NodeTypes . Solidity ,
351351 } ) ;
352- return result . balance ;
352+ return result ;
353353 } )
354354 . call ( this )
355355 . asCallback ( callback ) ;
@@ -381,6 +381,26 @@ export class Trx extends BaseCoin {
381381 . asCallback ( callback ) ;
382382 }
383383
384+ /**
385+ * Throws an error if any keys in the ownerKeys collection don't match the keys array we pass
386+ * @param ownerKeys
387+ * @param keysToFind
388+ */
389+ checkPermissions ( ownerKeys : { address : string ; weight : number } [ ] , keys : string [ ] ) {
390+ keys = keys . map ( k => k . toUpperCase ( ) ) ;
391+
392+ ownerKeys . map ( key => {
393+ const hexKey = key . address . toUpperCase ( ) ;
394+ if ( ! keys . includes ( hexKey ) ) {
395+ throw new Error ( `pub address ${ hexKey } not found in account` ) ;
396+ }
397+
398+ if ( key . weight !== 1 ) {
399+ throw new Error ( 'owner permission is invalid for this structure' ) ;
400+ }
401+ } ) ;
402+ }
403+
384404 /**
385405 * Builds a funds recovery transaction without BitGo.
386406 * We need to do three queries during this:
@@ -400,30 +420,34 @@ export class Trx extends BaseCoin {
400420 const keys = yield self . initiateRecovery ( params ) ;
401421
402422 // we need to decode our bitgoKey to a base58 address
403- const bitgoAddress = self . compressedPubToHexAddress ( self . xpubToCompressedPub ( params . bitgoKey ) ) ;
423+ const bitgoHexAddr = self . compressedPubToHexAddress ( self . xpubToCompressedPub ( params . bitgoKey ) ) ;
404424 const recoveryAddressHex = bitgoAccountLib . Trx . Utils . getHexAddressFromBase58Address ( params . recoveryDestination ) ;
405425
406426 // call the node to get our account balance
407- const recoveryAmount = yield self . getAccountBalanceFromNode ( bitgoAddress ) ;
427+ const account = yield self . getAccountFromNode ( bitgoHexAddr ) ;
428+ const recoveryAmount = account . balance ;
408429
409430 const userXPub = keys [ 0 ] . neutered ( ) . toBase58 ( ) ;
410431 const userXPrv = keys [ 0 ] . toBase58 ( ) ;
411432 const backupXPub = keys [ 1 ] . neutered ( ) . toBase58 ( ) ;
412433
413- const userPrv = self . xprvToCompressedPrv ( userXPrv ) ;
414- const userHexAddr = self . compressedPubToHexAddress ( self . xpubToCompressedPub ( userXPub ) ) ;
415- const backupHexAddr = self . compressedPubToHexAddress ( self . xpubToCompressedPub ( backupXPub ) ) ;
416-
417434 // construct the tx -
418435 // there's an assumption here being made about fees: for a wallet that hasn't been used in awhile, the implication is
419436 // it has maximum bandwidth. thus, a recovery should cost the minimum amount (1e6 sun or 1 Tron)
420437 if ( 1e6 > recoveryAmount ) {
421438 throw new Error ( 'Amount of funds to recover wouldnt be able to fund a send' ) ;
422439 }
423440 const recoveryAmountMinusFees = recoveryAmount - 1e6 ;
424- const buildTx = yield self . getBuildTransaction ( recoveryAddressHex , bitgoAddress , recoveryAmountMinusFees ) ;
441+ const buildTx = yield self . getBuildTransaction ( recoveryAddressHex , bitgoHexAddr , recoveryAmountMinusFees ) ;
425442
426- // TODO: some checks here about pubs being valid, for this wallet, etc. from build transaction
443+ // run a check to ensure this is a valid tx
444+ const keyHexAddresses = [
445+ self . compressedPubToHexAddress ( self . xpubToCompressedPub ( userXPub ) ) ,
446+ self . compressedPubToHexAddress ( self . xpubToCompressedPub ( backupXPub ) ) ,
447+ bitgoHexAddr ,
448+ ] ;
449+ self . checkPermissions ( account . owner_permission . keys , keyHexAddresses ) ;
450+ self . checkPermissions ( account . active_permission [ 0 ] . keys , keyHexAddresses ) ;
427451
428452 // construct our tx
429453 const txBuilder = new bitgoAccountLib . TransactionBuilder ( { coinName : this . getChain ( ) } ) ;
@@ -434,6 +458,8 @@ export class Trx extends BaseCoin {
434458 return txBuilder . build ( ) . toJson ( ) ;
435459 }
436460
461+ const userPrv = self . xprvToCompressedPrv ( userXPrv ) ;
462+
437463 txBuilder . sign ( { key : userPrv } ) ;
438464
439465 // krs recoveries don't get signed
0 commit comments